I've found something else in WordPress with this simple search method that I'd argue is worse.
WordPress base configuration files on GitHub
51–60 of 90 posts
Re: WordPress base configuration files on GitHub
#52"Passwords" in the title is a bit misleading. Most of these are staging files with little or no sensitive information there. However there is the odd bit of interesting data there if you look hard enough. Github search is an untapped resource just like Algolia Search is on Hackernews. Infact I have largely replaced my Google searches with these ones for more refined and curated results.
It's not an untapped resource, there are plenty of bots that search for creds then use them. Here one example: http://www.devfactor.net/2014/12/30/2375-amazon-mistake/
Re: WordPress base configuration files on GitHub
#53Security experts, I have a question: if a database server just allow connections from a white list (trusted IP's), exposing database passwords on a GIT repository is still a problem?
[I not saying I am an expert] It is always a problem to expose passwords. Sure they can't use it from the outside, but what's the point of even having the password if its public? The password is to prevent unauthorized access. If they are able to get to a box, and pivots, that password becomes useful to the attacker.
Re: WordPress base configuration files on GitHub
#54Security experts, I have a question: if a database server just allow connections from a white list (trusted IP's), exposing database passwords on a GIT repository is still a problem?
In any case where having passwords is relevant to security rather than just a hindrance to usability, exposing passwords is a security problem. If exposing a password isn't a security problem, you shouldn't require a password in the first place.
Re: WordPress base configuration files on GitHub
#55Earlier quoted context omitted.
Exactly. Also remember that on many many wordpress servers you also have phpMyAdmin. You can use the username + password to login, and you'll get access even when it's restricted to localhost.
It's pretty scary to have phpMyAdmin public facing. IIRC some older versions of mysql-server even had a bug where it'd let you in with a random password in 1/256 chance!
It should be really bad, since phpmyadmin get attempts are the most frequent on my home webserver and I don't even have it installed. Maybe older vulnerable versions are still around though.
Re: WordPress base configuration files on GitHub
#56At what point do developers get criticized/held responsible for using public repositories for private websites? I get it, people like github but when you can get a private repo on bitbucket for free there's no excuse for this.
Github does have a wider set of services that integrate with it. That said, if you have to go Github, private repos aren't that expensive. (And more services seem to be recognizing that Bitbucket is an increasingly popular options)
Re: WordPress base configuration files on GitHub
#57At what point do developers get criticized/held responsible for using public repositories for private websites? I get it, people like github but when you can get a private repo on bitbucket for free there's no excuse for this.
or just a bare repo on your server. I personally don't see the appeal of Github for private projects at all.
Many hosted solutions integrate with private Github (OpsWorks, Codeship, CircleCI, CodeClimate, and many more).
Re: WordPress base configuration files on GitHub
#58Earlier quoted context omitted.
localhost in the case of Wordpress just means the database is running on the same machine as the web server. Practically every WP instance is set up that way.
> localhost in the case of Wordpress Uh, the concept of localhost is not unique to Wordpress in the slightest.
That's not what he meant. What he meant was reading that the database is on localhost doesn't mean it's a development system. Many production instances of Wordpress run the database on the same host. Therefore localhost can also mean production. That might not be true for other services, but for Wordpress that's common. This is what he meant.
Re: WordPress base configuration files on GitHub
#59150,000,000+ database passwords, of which 99.9999%+ are from local development servers.
Excluding localhost and some obvious cases where the values are in a local config file still leaves around 111,000: https://github.com/search?p=1&q=filename%3Awp-config.php+DB_...
Which would be 99.99926% :-)
Re: WordPress base configuration files on GitHub
#60"Passwords" in the title is a bit misleading. Most of these are staging files with little or no sensitive information there. However there is the odd bit of interesting data there if you look hard enough. Github search is an untapped resource just like Algolia Search is on Hackernews. Infact I have largely replaced my Google searches with these ones for more refined and curated results.
What do you mean with staging files, what is not sensitive about username and password of the database?